CWE-749
AllowedExposed Dangerous Method or Function
Abstraction: Base · Status: Incomplete
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
350 vulnerabilities reference this CWE, most recent first.
GHSA-CM46-GQF4-MV4F
Vulnerability from github – Published: 2024-11-12 19:56 – Updated: 2024-12-16 15:27Impact
This vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within the Screen class, leading to potential brute force of database tables, validation checks against user credentials, and disclosure of the server’s real IP address.
Patches
The issue has been patched in the latest release, version 14.43.0, released on November 6, 2024. Users should upgrade to version 14.43.0 or later to address this vulnerability.
Workarounds
If upgrading to version 14.43.0 is not immediately possible, you can mitigate the vulnerability by implementing middleware to intercept and validate requests to asynchronous modal endpoints, allowing only approved methods and parameters.
Example middleware:
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;
class PreventBruteForceOnAsyncRoute
{
/**
* Methods that are restricted from being invoked via the async route.
*/
protected array $restrictedMethods = [
'validate',
'handle',
'__invoke',
'validateWith',
'validateWithBag',
'callAction',
];
/**
* Handle an incoming request.
*/
public function handle(Request $request, Closure $next): Response
{
// Retrieve the current route from the request.
/** @var \Illuminate\Routing\Route|null $route */
$route = $request->route();
// Allow requests to routes other than "platform.async".
if ($route?->getName() !== 'platform.async') {
return $next($request);
}
// Block requests attempting to invoke any of the restricted methods.
if (in_array($route->parameter('method'), $this->restrictedMethods)) {
abort(503, sprintf(
'Access to the "%s" method is restricted.',
$route->parameter('method')
));
}
// Continue request processing for other cases.
return $next($request);
}
}
References
Acknowledgements
We would like to extend our sincere gratitude to Positive Technologies and researcher Vladislav Gladky for identifying the vulnerability and their significant contribution to enhancing the security of our platform. Their expertise and dedication play a crucial role in making Orchid more reliable and secure for all users.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "orchid/platform"
},
"ranges": [
{
"events": [
{
"introduced": "8.0"
},
{
"fixed": "14.43.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-51992"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": true,
"github_reviewed_at": "2024-11-12T19:56:54Z",
"nvd_published_at": "2024-11-11T20:15:19Z",
"severity": "MODERATE"
},
"details": "### Impact\nThis vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform\u2019s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within the `Screen` class, leading to potential brute force of database tables, validation checks against user credentials, and disclosure of the server\u2019s real IP address.\n\n### Patches\nThe issue has been patched in the latest release, version 14.43.0, released on November 6, 2024. Users should upgrade to version 14.43.0 or later to address this vulnerability.\n\n### Workarounds\nIf upgrading to version 14.43.0 is not immediately possible, you can mitigate the vulnerability by implementing middleware to intercept and validate requests to asynchronous modal endpoints, allowing only approved methods and parameters.\n\n\nExample middleware:\n\n```php\nnamespace App\\Http\\Middleware;\n\nuse Closure;\nuse Illuminate\\Http\\Request;\nuse Symfony\\Component\\HttpFoundation\\Response;\n\nclass PreventBruteForceOnAsyncRoute\n{\n /**\n * Methods that are restricted from being invoked via the async route.\n */\n protected array $restrictedMethods = [\n \u0027validate\u0027,\n \u0027handle\u0027,\n \u0027__invoke\u0027,\n \u0027validateWith\u0027,\n \u0027validateWithBag\u0027,\n \u0027callAction\u0027,\n ];\n\n /**\n * Handle an incoming request.\n */\n public function handle(Request $request, Closure $next): Response\n {\n // Retrieve the current route from the request.\n /** @var \\Illuminate\\Routing\\Route|null $route */\n $route = $request-\u003eroute();\n\n // Allow requests to routes other than \"platform.async\".\n if ($route?-\u003egetName() !== \u0027platform.async\u0027) {\n return $next($request);\n }\n\n // Block requests attempting to invoke any of the restricted methods.\n if (in_array($route-\u003eparameter(\u0027method\u0027), $this-\u003erestrictedMethods)) {\n abort(503, sprintf(\n \u0027Access to the \"%s\" method is restricted.\u0027,\n $route-\u003eparameter(\u0027method\u0027)\n ));\n }\n\n // Continue request processing for other cases.\n return $next($request);\n }\n}\n```\n\n### References\n- [CWE-749: Exposed Dangerous Method or Function](https://cwe.mitre.org/data/definitions/749.html)\n\n### Acknowledgements\n\nWe would like to extend our sincere gratitude to **Positive Technologies** and researcher **Vladislav Gladky** for identifying the vulnerability and their significant contribution to enhancing the security of our platform. Their expertise and dedication play a crucial role in making **Orchid** more reliable and secure for all users.\n",
"id": "GHSA-cm46-gqf4-mv4f",
"modified": "2024-12-16T15:27:59Z",
"published": "2024-11-12T19:56:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/orchidsoftware/platform/security/advisories/GHSA-cm46-gqf4-mv4f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51992"
},
{
"type": "PACKAGE",
"url": "https://github.com/orchidsoftware/platform"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Orchid Platform has Method Exposure Vulnerability in Modals"
}
GHSA-CVPR-RM84-X4HJ
Vulnerability from github – Published: 2026-05-13 00:48 – Updated: 2026-05-13 00:48The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.
{
"affected": [],
"aliases": [
"CVE-2026-8108"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T23:16:19Z",
"severity": "HIGH"
},
"details": "The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions.",
"id": "GHSA-cvpr-rm84-x4hj",
"modified": "2026-05-13T00:48:14Z",
"published": "2026-05-13T00:48:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8108"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-132-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-132-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-CWRJ-XG8W-3XJ5
Vulnerability from github – Published: 2025-12-24 00:30 – Updated: 2025-12-24 00:30RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27660.
{
"affected": [],
"aliases": [
"CVE-2025-14491"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-23T22:15:50Z",
"severity": "HIGH"
},
"details": "RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27660.",
"id": "GHSA-cwrj-xg8w-3xj5",
"modified": "2025-12-24T00:30:15Z",
"published": "2025-12-24T00:30:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14491"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1164"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F3QH-P6VF-FRVJ
Vulnerability from github – Published: 2022-05-17 03:46 – Updated: 2025-11-05 00:31Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.
{
"affected": [],
"aliases": [
"CVE-2014-5415"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-05T10:59:00Z",
"severity": "CRITICAL"
},
"details": "Beckhoff Embedded PC images before 2014-10-22 and Automation Device Specification (ADS) TwinCAT components might allow remote attackers to obtain access via the (1) Windows CE Remote Configuration Tool, (2) CE Remote Display service, or (3) TELNET service.",
"id": "GHSA-f3qh-p6vf-frvj",
"modified": "2025-11-05T00:31:12Z",
"published": "2022-05-17T03:46:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-5415"
},
{
"type": "WEB",
"url": "https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-001.pdf"
},
{
"type": "WEB",
"url": "https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-002.pdf"
},
{
"type": "WEB",
"url": "https://download.beckhoff.com/download/document/product-security/Advisories/advisory-2014-003.pdf"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2016/icsa-16-278-02.json"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-278-02"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-16-278-02"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93349"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F4MH-7QWC-2533
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2024-01-23 15:30A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine's internals. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.7.
{
"affected": [],
"aliases": [
"CVE-2019-20923"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-23T16:15:00Z",
"severity": "MODERATE"
},
"details": "A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which throw unhandled Javascript exceptions containing types intended to be scoped to the Javascript engine\u0027s internals. This issue affects: MongoDB Inc. MongoDB Server v4.0 versions prior to 4.0.7.",
"id": "GHSA-f4mh-7qwc-2533",
"modified": "2024-01-23T15:30:55Z",
"published": "2022-05-24T17:34:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20923"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/SERVER-39481"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F5VJ-F2HX-8M93
Vulnerability from github – Published: 2026-07-20 22:01 – Updated: 2026-07-20 22:01Impact
The internal /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints perform state-changing actions on any GET request, without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.
An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root (e.g. ~/.ssh/config). The file's contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer's machine.
Patches
Fixed in webpack-dev-server 5.2.6 by rejecting cross-site requests to the /webpack-dev-server/open-editor and /webpack-dev-server/invalidate endpoints (see PR #5698).
Workarounds
None
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.2.5"
},
"package": {
"ecosystem": "npm",
"name": "webpack-dev-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-14620"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-749"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-20T22:01:56Z",
"nvd_published_at": "2026-07-03T17:16:53Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nThe internal `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints perform state-changing actions on any `GET` request, without verifying that the request originated from the dev server\u0027s own page. Any website a developer visits while the dev server is running can trigger them cross-origin with no interaction beyond the visit.\n\nAn attacker can open an arbitrary existing local file in the developer\u0027s editor, including files outside the project root (e.g. `~/.ssh/config`). The file\u0027s contents are not returned to the attacker. Repeated requests can also spawn editor processes and force recompilations, degrading the developer\u0027s machine.\n\n### Patches\n\nFixed in `webpack-dev-server` 5.2.6 by rejecting cross-site requests to the `/webpack-dev-server/open-editor` and `/webpack-dev-server/invalidate` endpoints (see [PR #5698](https://github.com/webpack/webpack-dev-server/pull/5698)).\n\n### Workarounds\n\nNone",
"id": "GHSA-f5vj-f2hx-8m93",
"modified": "2026-07-20T22:01:56Z",
"published": "2026-07-20T22:01:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/webpack/webpack-dev-server/security/advisories/GHSA-f5vj-f2hx-8m93"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14620"
},
{
"type": "WEB",
"url": "https://github.com/webpack/webpack-dev-server/pull/5698"
},
{
"type": "WEB",
"url": "https://github.com/webpack/webpack-dev-server/commit/80cd9eea54975fe632a518d8bd902a260f374e7c"
},
{
"type": "WEB",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/webpack/webpack-dev-server"
},
{
"type": "WEB",
"url": "https://github.com/webpack/webpack-dev-server/releases/tag/v5.2.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints"
}
GHSA-FH72-RHCQ-WPF6
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-06-26 21:31Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.
{
"affected": [],
"aliases": [
"CVE-2025-5823"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-25T18:15:23Z",
"severity": "MODERATE"
},
"details": "Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Autel MaxiCharger AC Wallbox Commercial EV chargers. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the Autel Technician API. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-26351.",
"id": "GHSA-fh72-rhcq-wpf6",
"modified": "2025-06-26T21:31:13Z",
"published": "2025-06-26T21:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5823"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-341"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FHM6-67QQ-3Q35
Vulnerability from github – Published: 2022-05-17 04:52 – Updated: 2025-08-23 00:31An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.
{
"affected": [],
"aliases": [
"CVE-2014-0758"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-02-24T04:48:00Z",
"severity": "HIGH"
},
"details": "An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document.",
"id": "GHSA-fhm6-67qq-3q35",
"modified": "2025-08-23T00:31:12Z",
"published": "2022-05-17T04:52:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0758"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-051-01"
},
{
"type": "WEB",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-051-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FJ6X-XHQ4-HQ99
Vulnerability from github – Published: 2024-05-03 03:30 – Updated: 2024-05-03 03:30Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.
The specific flaw exists within the Ignition Gateway server. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20541.
{
"affected": [],
"aliases": [
"CVE-2023-38124"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T03:15:10Z",
"severity": "HIGH"
},
"details": "Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the Ignition Gateway server. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20541.",
"id": "GHSA-fj6x-xhq4-hq99",
"modified": "2024-05-03T03:30:56Z",
"published": "2024-05-03T03:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38124"
},
{
"type": "WEB",
"url": "https://inductiveautomation.com/blog/inductive-automation-participates-in-pwn2own-to-strengthen-ignition-security"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1015"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FWJP-3G6W-X33Q
Vulnerability from github – Published: 2025-12-24 00:30 – Updated: 2025-12-24 00:30RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27678.
{
"affected": [],
"aliases": [
"CVE-2025-14496"
],
"database_specific": {
"cwe_ids": [
"CWE-749"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-23T22:15:50Z",
"severity": "HIGH"
},
"details": "RealDefense SUPERAntiSpyware Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of RealDefense SUPERAntiSpyware. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the SAS Core Service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27678.",
"id": "GHSA-fwjp-3g6w-x33q",
"modified": "2025-12-24T00:30:16Z",
"published": "2025-12-24T00:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14496"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1171"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
Mitigation
Strategy: Attack Surface Reduction
- Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be:
- Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.
- accessible to all users
- restricted to a small set of privileged users
- prevented from being directly accessible at all
CAPEC-500: WebView Injection
An adversary, through a previously installed malicious application, injects code into the context of a web page displayed by a WebView component. Through the injected code, an adversary is able to manipulate the DOM tree and cookies of the page, expose sensitive information, and can launch attacks against the web application from within the web page.